View Full Version : RF MICROPHONES

04-01-2010, 09:40 PM
Hi all, can anybody tell me how one can locate the listening post of a hardwire bug? I read somewhere that RF microphones, once found, can be traced back to the listening post, but I couldn't find the "how"... Probably some tool that gets into the same listening frequencies? But does it have to be in use to locate it?


04-02-2010, 01:22 AM
Is it wireless?

04-02-2010, 02:28 AM
Firstly, there's terminology. By "RF Microphone" I presume you mean a "bug" listening device, microphone with a small battery-powered radio transmitter, and yes, that would be wireless. These can be detected while they're transmitting (they're usually on all the time while operating and can last perhaps hours, days or weeks on a battery) surely with "detection equipment" sold for the purpose. One piece of general equipment that could be used is an RF spectrum analyzer, a largish box costing thousands of dollars, and displaying every radio transmission that can be received in the room. As you move its short antenna around, the mic's radio signal will go up and down as you get closer to it.

There may be a technical way to find the receiver - usually there's a local oscillator in the receiver at 455kHz or 10.7MHz above the transmitters frequency, depending on the band. This will be a VERY faint signal, as it's not meant to exit the receiver at all, but a sensitive enough equipment can sometime pick it up. It is located by the usual walking around, with a higher signal strength usually indicating getting closer to the receiver.

but perhaps the listener can be discovered by "social engineering" - maybe have an "audio drama" (you might want to video it so it's clear it was faked) where something really bad such as a murder "happens" and see who comes to the door. This could of course be dangerous, but if it's that important to find out who did it, this sort of thing is a possibility.

Perhaps less dangerous is have conversations about untrue things, and see where any stories of these things show up.

The info about it transmitting all the time is decades old - from the article below, modern bugs can store hours or days of audio on a memory chip, then only transmit it on command or at odd hours when someone might not be looking for it.

04-02-2010, 12:07 PM
Alot of these recievers have a limited range, so whoever is listening is not going to be far away, maybe within a mile or so.

Again it depends on the quality of the bug etc.

And wether it's a retrievable bug with an independant storage device, or something sending a singal to a 'live' seperate location.

There are shops where you can buy these things pretty cheap, so if you know what makeand model you want then you could research into that models parameters.

04-02-2010, 02:56 PM
With the right equipment you can almost certainly trace the transmitter. You could not find the receiver without a LOT of luck.

04-02-2010, 06:11 PM
Thanks -- I am assuming the bug IS found and then they want to locate the listening post. They would have to use a radio device that would tune in on the same frequency while the microphone is in use, correct? Does the 'locating device' have a technical name?

04-02-2010, 09:06 PM
I think the " locating device" does not exist. You invent it and call it whatever you like.

04-03-2010, 04:28 AM
I asked my husband, who's an EMC Engineer. He tells me that to detect RF(Radio Frequency) you would use a spectrum analyzer (http://en.wikipedia.org/wiki/Spectrum_analyzer) and an antenna. For finding something that's generating a radio frequency where you don't expect one, you'd use something like a 'sniffer antenna' (http://www.edn.com/article/CA6391433.html) - also known as a directional antenna.

04-03-2010, 06:15 PM
Great -- thanks so much! Also, you would have to have it transmit in order to detect the signal, right? In other words: suppose the bug is in the phone, when the phone is not being used, then the signal cannot be detected, hence the listening post cannot be traced, is this correct? Thanks for your help.

Edit: I think the answer to my question above is yes, after reading the links you gave me it seems pretty obvious that you would have to send the signal in order to detect where it gets received ... :)

04-03-2010, 09:30 PM
Yep, correct.

04-10-2010, 09:11 PM
35+ years of cb/ham radio. I dont see how it is possible to detect the receiver as it is a passive device and its not putting out any signals. The only way you might be able to detect the receiver is if it sends out a signal so the 'bug' transmits its information to the receiver, but that signal is only going to have to be miliseconds long so it would be nigh impossible to trace unless you were sitting right under it when it sent the signal.

yer pal Brian

04-10-2010, 10:09 PM
But isn't that what I was saying? That it should be IN USE to be detected?

So, suppose they open up the phone and find the bug (they suspect it's there, that's an assumption...), then they use it (they make some bogus call) with the sniffer antenna in action, and that's how they find the listening post... plausible?


04-10-2010, 10:09 PM
Can't detect the receiver - as Fingers points out - as it is 'passive'.


It sends something called a 'pilot tone'. This would NOT be the case in a device meant for surveillance, however - it's designed for wireless transmission of microphones used for broadcast purposes.

A sniffer or directional antenna - picks up the SOURCE of transmissions. TRANSmissions is the operative word. A RECEIVER - by definition - does not TRANSMIT a signal that can be found - with the exception of the above mentioned pilot tone.

04-10-2010, 10:22 PM
OK, thanks for the info. Let's take a step back, I'm confused: I read that RF microphones are the most vulnerable ones because the listening post CAN be detected. It was an article I found on the internet, if I find the link again I'll post it. Anyways, what it did not say was HOW you detect the listening post.

So, WriteKnight, are you saying that the sniffer antenna is used in SWEEPING the place, ie in order to find the bug itself? But then, wouldn't the police have some way of using the bug in order to trace the signal back to the listening post?

Thanks a bunch!!!

04-11-2010, 08:04 PM
A directional antenna is used to locate the directional SOURCE of a signal. The BUG is the source in this case - it is the one SENDING the signal - so yeah, it might be used to find the bug.

In the old spy movies - you sometimes saw the people tracking the spies using a truck with a circular antenna on top - turning the antenna this way and that to determine WHERE THEIR TRANSMISSION was coming from. Basically - that's the purpose of a directional antenna - to locate the SOURCE OF TRANSMISSION.

Since the 'reciever' is passive - it is simply 'on' waiting to receive the transmission - it is not actually SENDING out any sort of signal to be traced. (Except, as I noted above in the case of wireless microphones for broadcast)

Sure - if you find a link to the original article which details how the BUG'S TRANSMISSIONS can be followed back to the RECEIVER'S location - I'd love to read it. I'm not saying it's impossible - I'm just saying I don't know how it could be. SO please feel free to enlighten us.

04-11-2010, 10:05 PM
I can't find it, but even if I did it wouldn't be enlightening, it would be mind-boggling, because all it said was that the type of bugs that send into RF waves can be traced back to the listening post. It never said HOW that could be done, hence why I posted my question here to begin with. From what you're saying, the reason that they didn't say HOW may simply be that it can't be done and the statement was bogus.

Mac H.
04-12-2010, 02:16 AM
There is actually a very clever way to detect the listening post.

It was used by the British during the cold war.

Unlike the old AM crystal sets, a modern radio receiver usually has a modulator at the front stage:

Signal In (x) Internally generated frequency -> Internal signal for processing

It works because (Signal) modulated by (Frequency) just moves the (Signal) up by 'Frequency'. (And it has a mirror as -Signal as well, so if you move it up by enough, you'll effectively move it down too!)

That is why they are so easy to tune - you are basically just changing the frequency you are modulating the input at.

Then all the audio processing is just done at down at a known frequency.

However the British noticed that in an imperfect world, some of that modulating frequency the receiver was using would leak out of the input antenna. Only the tiniest of amounts, of course, but still detectable.

So that was what they would try to detect.

The other posters are right, of course - if the receiver was a fully passive device it would be a lot harder. But modern electronics hasn't been fully passive for quite a while !

To be fair, it seemed that the technique wasn't terribly successful. You force the input multiplier into 'leaking' by saturating it (probably by putting a lot of signal on another frequency). The signal you are looking for is so tiny considering the rest of the signals around in 1950 they could never reliably find the source in real situations. If the spectrum was noisy in 1950, I'd imagine the technique would be pretty unusable now !

Good luck,

(PS: Peter Wright described their use and basic functionality in his autobiography: http://en.wikipedia.org/wiki/Spycatcher

It turns out wiki even has an article on the technique, which would have saved me typing!!



04-12-2010, 04:11 AM
Sure - if you find a link to the original article which details how the BUG'S TRANSMISSIONS can be followed back to the RECEIVER'S location - I'd love to read it. I'm not saying it's impossible - I'm just saying I don't know how it could be. SO please feel free to enlighten us.
The receiver's local oscillator, as I mentioned in post #3. Its used in locating receivers is spelled out in Wikipedia's article on superhetrodyne receivers (in use by virtually all receivers from perhaps the 1930's to the present.
http://en.wikipedia.org/wiki/Superheterodyne_receiver#Local_oscillator_radiatio n

04-29-2010, 05:54 AM
benbradley is correct on this one.
As a communications technician who uses a spectrum analyzer on a regular basis. Even then, I can assure you that it is nearly impossible to detect the local oscillator of a receiver. But it would be the only way and you would need to be close and have a directional antenna.
if the spy was very clever he would not use standard IF frequencies but customize them so as to have the oscillator running on a frequency no one would look for.

L.C. Blackwell
05-02-2010, 05:32 AM
I just learned something new today. Thanks, ya'll! :)